CVE-2023-4792: Missing Authorization

The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicateppmcpostasdraft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with...

WordPress WP Custom Post Template Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Custom Post Template Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-41851 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bc76b275fbb6 Credits Rio Darmawan...

CVE-2023-33329

Auth. admin+ Reflected Cross-Site Scripting XSS vulnerability in Hijiri Custom Post Type Generator plugin = 2.4.2 versions...

CVE-2023-33329

Auth. admin+ Reflected Cross-Site Scripting XSS vulnerability in Hijiri Custom Post Type Generator plugin = 2.4.2 versions...

Cross site scripting

Auth. admin+ Reflected Cross-Site Scripting XSS vulnerability in Hijiri Custom Post Type Generator plugin = 2.4.2 versions...

CVE-2023-33329

CVE-2023-33329: Authenticated Reflected XSS in Hijiri Custom Post Type Generator plugin

CVE-2023-33329 WordPress Custom Post Type Generator Plugin <= 2.4.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Reflected Cross-Site Scripting XSS vulnerability in Hijiri Custom Post Type Generator plugin = 2.4.2 versions...

CVE-2023-33329 WordPress Custom Post Type Generator Plugin <= 2.4.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Reflected Cross-Site Scripting XSS vulnerability in Hijiri Custom Post Type Generator plugin = 2.4.2 versions...

WordPress Tweet Old Custom Post Plugin <= 19.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Tweet Old Custom Post Type Plugin Vulnerable versions = 19.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 052dae11c71c Credits Rafie Muhammad Patchstack...

CVE-2023-33329: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Reflected Cross-Site Scripting XSS vulnerability in Hijiri Custom Post Type Generator plugin = 2.4.2 versions...

CVE-2021-4415

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...

Cross site request forgery (csrf)

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...

CVE-2021-4415 Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...

WordPress Intuitive Custom Post Order Plugin < 3.1.4 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:intuitivecustompostorderproject:intuitivecustompostorder";...

WordPress Intuitive Custom Post Order Plugin < 3.1.5 SQLi Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:intuitivecustompostorderproject:intuitivecustompostorder";...

WordPress Duplicate Post Page Menu & Custom Post Type Plugin <= 2.4.1 is vulnerable to Broken Access Control

Software Duplicate Post Page Menu & Custom Post Type Type Plugin Vulnerable versions = 2.4.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36526 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID be002a065247 Credits...

CVE-2023-1016

The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.3, due to insufficient escaping on the user supplied 'objects' and 'tags' parameters and lack of sufficient preparation in the 'updateoptions' function as well as the 'refresh...

CVE-2023-1016

The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.3, due to insufficient escaping on the user supplied 'objects' and 'tags' parameters and lack of sufficient preparation in the 'updateoptions' function as well as the 'refresh...

Sql injection

The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.3, due to insufficient escaping on the user supplied 'objects' and 'tags' parameters and lack of sufficient preparation in the 'updateoptions' function as well as the 'refresh...

CVE-2023-1016

CVE-2023-1016 affects the WordPress plugin “Intuitive Custom Post Order” (versions up to 3.1.3;; and up to 3.1.4.x per PatchStack) with a SQL Injection due to insufficient escaping of user-supplied parameters (objects, tags) and inadequate preparation in the update_options and refresh functions. ...